ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 - StepSecurity

Customers

Pricing

Resources

Company

Request a Demo<br>Login

Customers

Pricing

Resources

Company

Start Free

Login

Back to Blog

Threat Intel

ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2

A self-propagating npm worm we call ChainDrop poisoned 444 packages and 2,212 versions in under four hours, starting with keyv@6.0.0. Full payload analysis, the affected package list, IOCs, and what to do now.

Sai Likhith<br>View LinkedIn

August 4, 2026

Share on X<br>Share on X<br>Share on LinkedIn<br>Share on Facebook<br>Follow our RSS feed

Table of Contents

Loading nav...

Last updated: August 4, 2026 at 18:10 UTC. Active investigation. Every package and version count in this post is as of this timestamp, and the number of compromised packages is still increasing as the worm keeps republishing itself. Our full technical analysis of the payload, and the runtime evidence from our own detonation, are included below.<br>TL;DR: On August 4, 2026 (UTC), a self-propagating supply chain worm, which we are calling ChainDrop , ripped through npm. In under four hours it poisoned 444 packages and 2,212 versions across more than a dozen victim organizations , including keyv@6.0.0 (over 150M weekly downloads), flat-cache@6.1.24 (149.9M), and file-entry-cache@11.1.6 (147.6M). Those three packages together sit inside a huge share of the JavaScript ecosystem, from ESLint (flat-cache, file-entry-cache) to everything built on cache-manager and cacheable. Every poisoned version carries the same infection pattern: a preinstall dropper that downloads the legitimate Bun JavaScript runtime, and a 710 KB obfuscated second stage that steals credentials, publishes more malicious packages, and burrows into AI developer tooling. Our analysis identifies the payload as a heavily evolved descendant of the Shai-Hulud 2.0 worm, now with an Ethereum blockchain C2 (EtherHiding), analyst-proof encrypted exfiltration, and persistence that targets Claude Code, VS Code, and GitHub Copilot workflows.<br>If you installed any of the affected versions listed below, assume your system is compromised.

Am I exposed? Answer it in one search<br>Check all 444 packages across your repos, CI, and dev machines in one search. Free account, 2 minutes.<br>Check My Exposure Free

This is a developing incident. All package and version counts in this post are as of the timestamp at the top, and the number is still increasing as the worm continues to republish itself with newly harvested credentials. Keep checking this blog post and the StepSecurity OSS Security Feed for the up to date list of compromised packages.

What we know so far<br>The StepSecurity OSS Security Feed flagged a surge of malicious npm package releases between 09:40 and 13:20 UTC on August 4, 2026, within minutes of each publication. The compromised versions follow a consistent pattern: they introduce heavily obfuscated files (setup.mjs and Math_Symbol.js, renamed math_init.js in the second wave) that execute automatically during npm install via a preinstall script, downloading a runtime and executing a second stage obfuscated payload. The speed and breadth of new compromised releases, spanning many unrelated maintainer scopes, indicates worm like, automated propagation using stolen maintainer credentials and tokens. We have now completed a full analysis of both stages, and the technical detail, IOCs, and propagation mechanics are documented in the sections below.<br>What sets this attack apart from the axios compromise of March 2026 is that the headline packages were published through npm's OIDC Trusted Publishing with valid SLSA provenance attestations . In the axios incident, the absence of provenance was the telltale signal. Here, the attacker compromised the maintainer's GitHub account, pushed poisoned release commits and tags, and let the projects' own release workflows ship the malware, cryptographically attested and indistinguishable from legitimate releases by any automated provenance check. Provenance proves which commit was built. It cannot prove the commit was authorized.

Compromised packages (flagged 09:40 to 13:20 UTC, August 4, 2026)<br>If any of these packages are in your dependency tree, direct or transitive, assume the versions listed are compromised.<br>The incident group breaks into two tiers. The first tier is the initial compromise: 11 verified full worm carriers in the jaredwray ecosystem, each shipping both the obfuscated setup.mjs loader and the complete 727,680 byte Math_Symbol.js credential worm, published through the projects' own trusted publishing workflows. The second tier is the worm's own work: 433 victim packages (2,201 versions), republished automatically using harvested CI credentials, each carrying the Bun downloader stager and the payload.<br>The 11 verified full worm carriers, all shipping the identical two file payload ("preinstall": "node setup.mjs" plus the...